CVE-2024-26877: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26877 affects the Linux kernel's Xilinx AES driver. The vulnerability was discovered when calling crypto_finalize_request without disabling bottom-half interrupts (BH), which could trigger a warning and potential system instability. This issue was identified in version 6.8.0-rc1 of the Linux kernel (Kernel Git).

The vulnerability occurs in the zynqmp_handle_aes_req function within the Xilinx AES driver. When crypto_finalize_request is called without proper interrupt handling, it can trigger a NULL pointer dereference warning at crypto/crypto_engine.c:58. The issue stems from a race condition where bottom-half interrupts are not properly disabled during the request finalization process (Kernel Git).

The vulnerability can lead to system warnings and potential instability in systems using the Xilinx AES cryptographic driver. While primarily affecting system reliability, it could potentially be used to cause a denial of service condition (Ubuntu Security).

The vulnerability requires local access to a system running the affected Xilinx AES driver. It can be triggered through normal cryptographic operations when using the affected driver (Kernel Git).

The issue has been fixed by adding proper bottom-half interrupt handling around the crypto_finalize_aead_request call. The fix involves adding local_bh_disable() before the request finalization and local_bh_enable() afterward. This patch has been merged into the Linux kernel and is available in updated versions (Kernel Git).